游戏行业ddos在aws的解决方案º‘游...aws中国(北京)区域由光环新网运营...
Post on 03-Jan-2021
25 Views
Preview:
TRANSCRIPT
AWS中国(北京)区域由光环新网运营
游戏行业DDOS在AWS的解决方案
狄颖伟,AWS解决方案架构师Yingwei Di, Solution Architect, Amazon Web Services
2017年7月18日18th July , 2017
AWS中国(北京)区域由光环新网运营
DDoS 攻击类型
AWS中国(北京)区域由光环新网运营
DDoS攻击类型
流量 DDoS 攻击
通过大流量造成网络拥塞 (e.g., UDP
reflection attacks)
AWS中国(北京)区域由光环新网运营
DDoS 攻击类型
资源耗尽 DDoS 攻击
通过网络协议使得诸如防火墙,负载均衡等设备资源耗尽 (e.g., TCP SYN flood)
AWS中国(北京)区域由光环新网运营
DDoS攻击类型
应用层 DDoS 攻击
用大量的真实请求消耗应用资源 (e.g., HTTP
GET)
AWS中国(北京)区域由光环新网运营
DDoS攻击趋势
Volumetric State exhaustion Application layer
65%Volumetric
17%State exhaustion
18%Application layer
AWS中国(北京)区域由光环新网运营
应对DDoS攻击的挑战
• 难以处理
Complex set-up Provision bandwidth capacity
Application re-architecture
AWS中国(北京)区域由光环新网运营
• 人工介入
Operator involvement to
initiate mitigation
Re-route traffic via distant
scrubbing location
Increased time to
mitigate
Traditional
Datacenter
应对DDoS攻击的挑战
AWS中国(北京)区域由光环新网运营
• 成本
应对DDoS攻击的挑战
AWS中国(北京)区域由光环新网运营
AWS 应对方法
AWS中国(北京)区域由光环新网运营
AWS DDoS防护
• 与全球基础资源集成
• 快速响应
• 链路冗余
AWS中国(北京)区域由光环新网运营
AWS内置DDoS防护
防护对基础设施的攻击
应对SYN/ACK Floods, UDP Floods,
等攻击
无额外费用DDoS mitigation
systems
DDoS Attack
Users
AWS中国(北京)区域由光环新网运营
AWS WAF
• 与CloudFront,ALB集成
• 支持API
• 策略– SQL注入
– CSRF
– IP地址
– 数据包特性
AWS中国(北京)区域由光环新网运营
AWS最佳实践• 最小化受攻击面
• 吸收
• 重点保护暴露的资源
• 熟悉正常网络情况
• 应对计划
AWS中国(北京)区域由光环新网运营
自动化防御
日志分析
CF log - S3 - Lambda
ELB log - S3 - Lambda
VPC flow log – CloudWatch
Log - Lambda
AWS中国(北京)区域由光环新网运营
客户还关心…
Does AWS protect me
from DDoS attacks?
What about large
DDoS attacks?
How can I get visibility
when I get attacked?
Does AWS protect
me from application
layer attacks?
Scaling for
DDoS attacks
is expensive.
I want to talk to
DDoS experts.
AWS中国(北京)区域由光环新网运营
• AWS Shield• A Managed DDoS Protection Service
AWS中国(北京)区域由光环新网运营
AWS Shield
标准保护 高级保护
• 提供给所有客户,无额外费用 付费服务,提供额外的服务和功能
AWS中国(北京)区域由光环新网运营
AWS Shield
与AWS服务集成IntegrationDDoS protection
without infrastructure
changes
经济Don’t force unnecessary
trade-offs between cost and
availability
灵活Customize protections
for your applications
持续侦测和压制Minimize impact on application
latency
特点…
AWS中国(北京)区域由光环新网运营
• AWS Shield 标准版
AWS中国(北京)区域由光环新网运营
AWS Shield 标准版
3/4层保护
Automatic detection & mitigation
Protection from most common
attacks (SYN/UDP Floods, Reflection
Attacks, etc.)
Built into AWS services
7层保护
AWS WAF for Layer 7 DDoS attack
mitigation
Self-service & pay-as-you-go
AWS中国(北京)区域由光环新网运营
• 更好的保护您运行在AWS上的资源
• 通过BlackWatch systems提升效果
• 持续监控和压制
• 无额外费用
AWS Shield 标准版
AWS中国(北京)区域由光环新网运营
• AWS Shield
Advanced• Managed DDoS Protection
AWS中国(北京)区域由光环新网运营
AWS Shield 高级版
Application Load Balancer Classic Load Balancer Amazon CloudFront Amazon Route 53
• 与AWS服务结合,需要business support
AWS中国(北京)区域由光环新网运营
AWS Shield 高级版
• 支持的区域
US East (N. Virginia) us-east-1
US West (Oregon) us-west-2
EU (Ireland) eu-west-1
Asia Pacific (Tokyo) ap-northeast-1
AWS中国(北京)区域由光环新网运营
AWS Shield 高级版
• AWS WAF与Application Load Balancer集成
Application Load BalancerAWS WAF
Valid users
Attackers
X
AWS中国(北京)区域由光环新网运营
AWS Shield 高级版
持续监控和侦测
高级 L3/4 & L7 DDoS 防护
攻击通知和报告24x7联系DDoS响应团队
AWS费用优惠
AWS中国(北京)区域由光环新网运营
持续监控和侦测
Network flow monitoring Application traffic monitoring
AWS中国(北京)区域由光环新网运营
• Detects anomalies based on attributes such
as:
• Source IP
• Source ASN
• Traffic levels
• Validated sources
异常检测
持续监控和侦测
AWS中国(北京)区域由光环新网运营
• Continuously baselining normal traffic
patterns
• HTTP Requests per second
• Source IP Address
• URLs
• User-Agents
基线
持续监控和侦测
AWS WAF支持基于rate的过滤
AWS中国(北京)区域由光环新网运营
AWS Shield 高级版
持续监控和侦测
高级 L3/4 & L7 DDoS 防护
攻击通知和报告24x7联系DDoS响应团队
AWS bill protection
AWS中国(北京)区域由光环新网运营
增强DDoS防护
Layer 7
application
protection
Layer 3/4
infrastructure
protection
AWS中国(北京)区域由光环新网运营
3/4层基础设施防护
高级防护技术技术
Deterministic
filtering
Traffic prioritization
based on scoring
Advanced routing policies
AWS中国(北京)区域由光环新网运营
• Automatically filters malformed
TCP packets
• IP checksum
• TCP valid flags
• UDP payload length
• DNS request validation
过滤技术
3/4层基础设施防护
AWS中国(北京)区域由光环新网运营
Low suspicion attributes
• Normal packet or request header
• Traffic composition and volume is typical given its source
• Traffic valid for its destination
High suspicion attributes
• Suspicious packet or request headers
• Entropy in traffic by header attribute
• Entropy in traffic source and volume
• Traffic source has a poor reputation
• Traffic invalid for its destination
• Request with cache-busting
流量优先级
3/4层基础设施防护
AWS中国(北京)区域由光环新网运营
• Inline inspection and scoring
• Preferentially discard lower priority (attack) traffic
流量优先级
High-suspicion
packets dropped
Low-suspicion
packets retained
3/4层基础设施防护
AWS中国(北京)区域由光环新网运营
• Distributed scrubbing and bandwidth
capacity
• Automated routing policies to absorb large
attacks
• Manual traffic engineering
高级路由策略
3/4层基础设施防护
AWS中国(北京)区域由光环新网运营
Layer 7
application
protection
Layer 3/4
infrastructure
protection
增强DDoS防护
AWS中国(北京)区域由光环新网运营
AWS WAF – 7层应用防护
Web traffic filtering
with custom rules
Malicious request
blocking
Active monitoring
and tuning
AWS中国(北京)区域由光环新网运营
AWS WAF – 7层应用防护
• 三种操作模式
Self-service Engage DDoS experts Proactive DRT engagement
AWS中国(北京)区域由光环新网运营
AWS WAF – 7层应用防护
• AWS WAF included at no
additional cost
自服务
AWS中国(北京)区域由光环新网运营
AWS WAF – 7层应用防护
1. You engage the AWS DDoS Response Team (DRT)
2. DRT triages attack
3. DRT assists you with creating AWS WAF rules
引入DDoS专家
AWS中国(北京)区域由光环新网运营
AWS WAF – 7层应用防护
1. Always-on monitoring engages the AWS DDoS
Response Team (DRT)
2. DRT proactively triages DDoS attack
3. DRT creates AWS WAF rules (prior
authorization required)
预先引入DRT
AWS中国(北京)区域由光环新网运营
AWS Shield 高级版
持续监控和侦测
高级 L3/4 & L7 DDoS 防护
攻击通知和报告24x7联系DDoS响应团队
AWS费用优惠
AWS中国(北京)区域由光环新网运营
攻击通知和报告
Attack monitoring
and detection
• Real-time notification of attacks via Amazon CloudWatch
• Near real-time metrics and packet captures for attack forensics
• Historical attack reports
AWS中国(北京)区域由光环新网运营
AWS Shield 高级版
持续监控和侦测
高级 L3/4 & L7 DDoS 防护
Attack notification and
reporting
24x7联系DDoS响应团队
AWS费用优惠
AWS中国(北京)区域由光环新网运营
24x7 联系DDoS 响应团队
• 关键、紧急事件迅速响应,直接与DRT专家沟通
• 复杂可由DTR 专家处理,DRT专家在保护AWS和amazon.com具有丰富的实践经验
AWS中国(北京)区域由光环新网运营
事前Proactive consultation and
best practice guidance
事中Attack mitigation
事后Post-mortem
analysis
24x7 联系DDoS 响应团队
AWS中国(北京)区域由光环新网运营
AWS Shield 高级版
持续监控和侦测
高级 L3/4 & L7 DDoS 防护
攻击通知和报告24x7联系DDoS响应团队
AWS费用优惠
AWS中国(北京)区域由光环新网运营
AWS 费用减免
• 减免因DDoS攻击造成的扩展费用
• Amazon CloudFront
• Elastic Load Balancer
• Application Load Balancer
• Amazon Route 53
AWS中国(北京)区域由光环新网运营
游戏DDoS防护
• 游戏应用组成• Web Portal – HTTP(S)
• Backend services, like Matchmaking – HTTP(S) / TCP
• Dedicated Game Servers - UDP
• Multiplayer Relay Servers - UDP
AWS中国(北京)区域由光环新网运营
• Web Portal and Match-MakingLayer 3/4 Attacks
SYN, ACK,..
Layer 7 Attacks
HTTP Floods
游戏DDoS防护
AWS中国(北京)区域由光环新网运营
• Game Servers & Relay Servers: UDP
• EC2 Traffic Shaping
• Auto-Mitigation
Region
EC2
EC2
EC2
Web Portal and
Matchmaking
awselb.amazon.com 11.23.92.12
游戏DDoS防护
AWS中国(北京)区域由光环新网运营
游戏DDoS防护—GameLift
AWS中国(北京)区域由光环新网运营
Thank You!
top related